This Privacy Policy describes how Holiander, Inc. ("Holiander," "we," "us"), a California S corporation, collects, uses, shares, and protects information in connection with Thorgate, our US trademark monitoring and deadline docketing service (the "Service") offered at thorgate.com. Thorgate is one of Holiander's products.

1. Who we are

Holiander operates the Service. We are the data controller for personal data processed about our customers and account users. For the marks and filing details customers submit for watching, we act as a processor; the customer is the controller.

For privacy questions or requests: support@thorgate.com.

2. What we collect

Account data. When you create an account, we collect your name, email address, and a hashed password. If you invite team members, we collect the same for them.

Workspace data. The marks you choose to watch, the Nice classes you select, and any filing details you provide (serial or registration numbers and dates). The notes you add. Your alert thresholds, digest delivery preferences, and the triage actions you take on findings.

Public register data. To operate the watch, we ingest and store a copy of the public USPTO trademark register. Those records are published by the US government and include mark text, serial and registration numbers, filing and status dates, goods and services classes, and the names of mark owners (which may be individuals). We process this public record data to run similarity scoring and status monitoring. We are the controller for this dataset; it is not collected from you, and we do not enrich it with data from other sources.

Billing data. A Stripe customer identifier and subscription status. We do not collect or store credit card numbers, Stripe holds those, and our service only sees the identifier and the subscription state.

Operational logs. Server access and error logs, including IP addresses, user agents, request paths, and response codes. Used for security, abuse prevention, and debugging.

Communications. Records of emails we send you (digests, account notices, support replies) and email contents you send us.

What we don't collect. We do not run third-party analytics, advertising trackers, marketing pixels, or session-replay tools. We do not buy data about you from third parties.

3. How we use it

We use the data we collect to:

Provide, operate, and improve the Service.
Send transactional email, account verification, password resets, digest emails, billing notices.
Process subscription billing through Stripe.
Detect and prevent abuse, fraud, and security incidents.
Respond to support requests.
Comply with legal obligations (tax, accounting, lawful requests from authorities).
Send service announcements (rarely; substantive product changes only).

We do not sell personal data. We do not share it with advertisers. We do not use customer data to train AI models.

4. Legal bases (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the legal bases on which we process personal data are:

Contractual necessity, to provide the Service you've agreed to.
Legitimate interests, for security, abuse prevention, internal analytics, and product improvement, balanced against your privacy interests.
Legal obligations, for tax, accounting, and lawful requests from authorities.
Consent, for any optional marketing communications you opt into. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

5. Subprocessors and data sharing

We use a small set of subprocessors to deliver the Service:

Our infrastructure provider (hosting, database, queue, search index). Register data and customer data are stored on servers we control.
Mailjet (email delivery, for digests and account notices).
Anthropic (AI class suggestions; only the goods/services description you type into the free class-suggester tool is sent, no customer-account data, no watched-mark data).
Stripe (subscription billing).
The USPTO (source of the public register; we retrieve bulk data from them, we do not send them customer data).

We notify customers by email before adding new subprocessors. If you object, you can terminate your subscription before the change takes effect.

We disclose personal data to government authorities only when legally required (subpoena, court order, valid legal process). We will notify you before complying when permitted by law.

6. International transfers

Holiander operates infrastructure in the United States. If you are in the EEA, UK, or Switzerland and your personal data is transferred to the US, the transfer is covered by the European Commission's Standard Contractual Clauses (SCCs) and supplementary measures.

EU/UK customers can request our Data Processing Agreement (which incorporates the SCCs as Module Two and Module Three) by emailing support@thorgate.com.

7. Data retention

Account data is retained for the life of your subscription. After cancellation, it is retained for an additional 60 days (during which you can recover the account by re-subscribing), then permanently deleted, except where retention is required for legal, tax, or accounting reasons.

Watched marks, findings, and deadlines are retained while your subscription is active, so your history and triage decisions persist. They are deleted with the account per the retention period above. You can request earlier deletion at any time.

Public register data is retained on an ongoing basis as an operating dataset, independent of any customer account, and refreshed from the USPTO. Deleting your account does not delete the public register, because it is not your data.

Operational logs are retained for 90 days, then deleted.

Communications. Support email threads and digest send logs are retained for 12 months for support and dispute resolution.

You can request export or earlier deletion at any time via support@thorgate.com.

8. Your rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA, CPRA, and similar laws), you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your data ("right to be forgotten").
Restrict or object to processing.
Receive your data in a portable format.
Withdraw consent for any processing based on consent.
Lodge a complaint with a supervisory authority (in the EEA: your local Data Protection Authority).

Submit any request to support@thorgate.com. We will respond within 30 days. We will not discriminate against you for exercising your rights.

9. California residents (CCPA / CPRA)

Holiander is registered in California and the Service is subject to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

The categories of personal information we process are described in section 2 above. The purposes of processing are described in section 3. Retention periods are described in section 7. The categories of third parties with whom we share information are described in section 5.

We do not "sell" personal information and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA / CPRA. We do not process sensitive personal information for purposes that would require an opt-out right under CPRA.

California residents may exercise their rights under the CCPA / CPRA, to know, delete, correct, port, limit use of sensitive PI, and not be discriminated against, by emailing support@thorgate.com.

10. Cookies and tracking

We use a single first-party session cookie for authentication. It is HttpOnly, Secure, and SameSite=Lax. Without it, you can't stay logged in.

We do not use cookies for advertising, retargeting, or third-party analytics. We do not run cross-site trackers or fingerprinting tools.

11. AI processing

Thorgate uses Anthropic's Claude API for one narrow purpose: suggesting Nice classification classes from a plain-English description of goods or services in our free class-suggester tool. The data sent is limited to the description text you type into that tool. We do not send customer-account data, watched marks, findings, settings, usage patterns, or notes to Anthropic. Similarity scoring, status monitoring, and deadline calculation are performed by our own code and do not involve any AI provider.

Anthropic's API terms prohibit use of API content for model training. Holiander does not use AI-generated outputs about you or your data for any purpose other than serving them to you in the Service.

12. Security

We implement industry-standard administrative, technical, and physical safeguards to protect data: TLS 1.3 for all transport, hashed passwords (bcrypt), isolated databases with distinct credentials, access logging, principle of least privilege for staff. Our infrastructure is described in section 5.

No method of internet transmission or storage is 100% secure. While we follow current best practices, we cannot guarantee absolute security. Notify us at support@thorgate.com if you believe there's been a security incident affecting your account.

13. Children's privacy

Thorgate is a business product not directed to anyone under 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected such data, we will delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated at least 30 days in advance via email and reflected in the "Last updated" date at the top of this page.

15. Contact

Questions about this Privacy Policy or to exercise any of your rights: support@thorgate.com.

Holiander, Inc.
California, United States

Privacy policy.